A Timeline of Major Android Malware Incidents (2025–2026)
Android malware isn’t a single, static threat — it’s a constantly shifting set of techniques, and looking at real, documented cases side by side reveals the patterns that matter more than any single incident does. Here’s a chronological look at the major campaigns security researchers have tracked over the past year, what each one actually did, and the common thread running through nearly all of them.
September 2025 — SlopAds
Identified by HUMAN Security, SlopAds involved 224 apps that collectively reached an estimated 38 million installs before being taken down. Like most large-scale ad-fraud operations, the apps functioned normally on the surface while running background ad-fraud activity invisible to the user.
Late 2025–Ongoing — Anatsa (a.k.a. TeaBot)
Anatsa is one of the most persistent Android banking trojans in recent memory, and it illustrates a specific technique worth understanding on its own: the dropper pattern. Rather than including malicious code in the initial download, Anatsa’s distribution apps — frequently disguised as PDF readers or QR code readers — pass Google Play’s review process looking completely clean. Only after installation does the app prompt the user to install an “update,” and that second-stage download is where the actual banking-trojan payload arrives.
Security researchers at Zscaler documented Anatsa specifically targeting applications from over 650 financial institutions, primarily across Europe, with observed activity also hitting banking apps in the US and UK. The malware includes evasion techniques like detecting whether it’s running in a virtual/analysis environment and deliberately corrupting parts of its own file structure to make static analysis harder.
The lesson: an app passing store review and looking clean on install is not the same as an app being safe long-term. The “update” prompt inside an already-installed app deserves the same scrutiny as the original install — arguably more, since it arrives after your guard is already down.
March 2026 — System File Rewrite Campaign
McAfee identified a set of apps exploiting older, unpatched Android vulnerabilities to rewrite a core system file, allowing every app on the affected phone to run attacker-controlled code. Notably, this malware was able to clone active WhatsApp sessions and persist through a factory reset — normally the most reliable way to remove malware from a device. This specific campaign only affected devices that hadn’t received a security update since May 2021, underscoring how much unpatched, outdated devices expand the attack surface.
May 2026 — Trapdoor
HUMAN Security identified Trapdoor across 455 apps with a combined 24 million installs — another large-scale campaign in the same ad-fraud/malicious-loader category as SlopAds, reinforcing that these aren’t isolated incidents but an ongoing, industrial-scale pattern.
February–July 2026 — Gigabud/Vwork Banking App Cloning
Covered in more depth in our guide to spotting fake and cloned apps, this Group-IB–documented scheme cloned banking, airline, and government-service apps, distributing them through phishing links rather than app stores. Its most technically notable feature: installing the cloned app inside a hidden Android work profile specifically to evade security signals that would normally follow it. Researchers tied this specific scheme to roughly 1,469 compromised devices and estimated losses near $960,000 in Indonesia during the six-month tracking window.
July 2026 — AfterCall
DoubleVerify identified AfterCall, an ad-fraud campaign appearing across dozens of apps per month, each showing a full-screen ad immediately after every phone call — a persistent, high-friction pattern designed to maximize ad impressions rather than steal data directly.
July 2026 — Free VPN Data Leak Study
An academic study tested 281 free Android VPN apps and found that 29 leaked user traffic outside the intended encrypted tunnel, while 61 transmitted data without encryption entirely — defeating the core purpose of a VPN. This wasn’t a single malicious campaign so much as a systemic finding: a large share of free VPN apps fail at the one thing they claim to do.
The Scale, in Perspective
According to Google’s own 2026 security reporting, Play Protect identified 27 million malicious sideloaded apps in 2025 — up from 13 million in 2024. Sideloaded sources are estimated to contain roughly 50 times more malware than apps distributed through Google Play, per industry reporting on Google’s data.
That statistic is not an argument against sideloading itself — plenty of legitimate software is only available that way — but it is a clear argument for verifying sources carefully every time, rather than assuming safety by default.
The Pattern That Connects Almost Every Case Above
Look across these incidents and one theme repeats constantly: the “update” prompt. Trapdoor, the Anatsa droppers, and multiple fake-utility-app campaigns all used a fake in-app update request to pull down the real malicious payload after already passing initial review. The advice that follows directly from this: never trust an in-app update prompt with the same passive acceptance you’d give a routine notification — treat it with the same scrutiny as installing something new, because functionally, it is.
What This Means for How You Install Anything
- Check permissions against purpose, every time — this catches the majority of the campaigns above at the install step.
- Treat “update” prompts as a second install decision, not a routine tap-through.
- Keep your device’s security patches current — several of the campaigns above specifically relied on old, unpatched vulnerabilities.
- Verify the source before the file, not after.
For the full verification process we use before publishing any listing, see our Complete Guide to APK Safety.
FAQ
Is Android less secure than iOS because of this? Android’s open architecture and sideloading support does mean a larger volume of malware activity compared to iOS’s more closed ecosystem — but this reflects a different attack surface, not simply “less secure” in every dimension. Both platforms face real, distinct threats.
Does this mean I shouldn’t sideload apps at all? No — it means verifying the source matters more, not that sideloading itself should be avoided entirely. Millions of legitimate installs happen outside app stores every day without incident.
What’s the single most repeated technique across these incidents? The fake in-app “update” prompt used to deliver a malicious payload after the initial app has already passed review and looks clean.
How often should I check for Android security updates? Check immediately when notified, and periodically confirm manually (Settings → Security → Security update) — several major campaigns specifically targeted devices that had gone years without a patch.
Part of ApkPrompt’s Trust Center. See also: How to Spot a Fake or Cloned Android App, The Complete Guide to APK Safety.